Skill UI

Systematic Windows privilege escalation guide covering enumeration, credential harvesting, service abuse, token impersonation, kernel exploits and configuration flaws to elevate from standard user to Administrator/SYSTEM during pentests.

This skill analyzes Active Directory (AD) Access Control Lists (ACLs) to detect dangerous misconfigurations. It uses the ldap3 Python library to query domain controllers, parse security descriptors (SDDL), and identify instances where non-privileged users or groups are granted dangerous permissions like GenericAll, WriteDACL, or WriteOwner on sensitive objects. Essential for security incident response and privilege escalation path discovery.

This skill guides users on querying Azure Monitor activity and sign-in logs using KQL to detect sophisticated security threats. It covers identifying suspicious administrative activities, impossible travel scenarios, privilege escalation attempts, and unauthorized resource modifications. Ideal for Security Operations Center (SOC) analysts building advanced threat hunting rules or developing cloud SIEM detections.

This guide details the comprehensive process of using the Linux Audit framework (auditd) to detect advanced security threats. It covers deploying specific rules to monitor critical system files, detecting unauthorized privilege escalation, process injection, and suspicious system calls. Users can then leverage ausearch and aureport to efficiently query, reconstruct timelines, and summarize findings for forensic analysis and compliance auditing.

A comprehensive toolkit using Splunk's SPL language to analyze Windows Security, System, and Sysmon event logs. It maps advanced detection queries to specific MITRE ATT&CK techniques, enabling SOC analysts to investigate authentication attacks (e.g., brute force, password spraying), detect privilege escalation, locate persistence mechanisms, and trace lateral movement for detailed forensic timeline analysis.

This utility provides comprehensive security auditing for Kubernetes Role-Based Access Control (RBAC) configurations. It identifies overly permissive roles, dangerous wildcard permissions (*), critical ClusterRoleBindings, and potential privilege escalation paths. By integrating tools like rbac-tool, KubiScan, and Kubeaudit, it helps users enforce the principle of least privilege, crucial for compliance and security assessments on EKS, GKE, and AKS clusters.

Systematically review Kubernetes RBAC roles, bindings, and service accounts to surface overly permissive access, privilege escalation paths, and least-privilege violations using tools like rbac-tool and KubiScan.

This guide details the systematic process of creating comprehensive incident response playbooks and runbooks. It covers structured procedures, decision trees, RACI matrices, and escalation protocols for various incident types (e.g., ransomware, data breach). Designed for maturing an Incident Response (IR) program, maintaining compliance (SOC 2, HIPAA), and integrating automated workflows into SOAR platforms, aligning with NIST SP 800-61r3 standards.

This framework defines a comprehensive, context-driven matrix for managing security incidents within a Security Operations Center (SOC). It details tiered escalation paths, response Service Level Agreements (SLAs), and notification procedures based not only on severity (P1-P4) but also on business risk, asset criticality, and data sensitivity. It guides analysts through triage, investigation, and timely escalation to management (CISO/Legal) to ensure rapid containment and appropriate organizational response during a breach.

This skill provides a comprehensive framework for tracking vulnerability aging and enforcing Service Level Agreements (SLAs). It calculates time-to-remediation against severity-based deadlines (e.g., 14 days for critical), incorporating adaptive modifiers and automated escalation paths. It is essential for establishing compliance policies, measuring remediation efficiency, and managing organizational risk.

This skill analyzes AWS CloudTrail logs to detect suspicious API call patterns, such as new event sources, geographic anomalies, or high-frequency usage. It establishes a statistical baseline of normal activity and flags deviations indicative of compromised credentials, privilege escalation, or insider threats, providing a detailed JSON report for security investigation and threat hunting.

This skill analyzes AWS IAM policies using boto3 and Cloudsplaining principles to detect potential privilege escalation paths in AWS accounts. It identifies overly permissive policies, dangerous permission combinations (such as combining role passing and resource creation), and violations of least-privilege principles. It is designed for security incident investigation, threat hunting, and validating overall cloud security posture.